{"id":15871270,"url":"https://github.com/glennchia/rhel8-systems-manager","last_synced_at":"2026-04-30T10:35:34.557Z","repository":{"id":108131538,"uuid":"296554287","full_name":"GlennChia/rhel8-systems-manager","owner":"GlennChia","description":"Exploring the use of Systems Manager for RHEL8","archived":false,"fork":false,"pushed_at":"2020-10-23T08:26:26.000Z","size":1157,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-02-07T14:45:13.386Z","etag":null,"topics":["aws","rhel8","systems-manager"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/GlennChia.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-09-18T08:00:33.000Z","updated_at":"2020-10-23T08:26:28.000Z","dependencies_parsed_at":null,"dependency_job_id":"b3e6aec5-681e-4f14-afd8-ca7318de3dfa","html_url":"https://github.com/GlennChia/rhel8-systems-manager","commit_stats":{"total_commits":14,"total_committers":2,"mean_commits":7.0,"dds":0.0714285714285714,"last_synced_commit":"06af0ee4b8e175392b25d3632e4189cb83b28fac"},"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GlennChia%2Frhel8-systems-manager","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GlennChia%2Frhel8-systems-manager/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GlennChia%2Frhel8-systems-manager/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GlennChia%2Frhel8-systems-manager/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/GlennChia","download_url":"https://codeload.github.com/GlennChia/rhel8-systems-manager/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246719983,"owners_count":20822831,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","rhel8","systems-manager"],"created_at":"2024-10-06T00:42:33.555Z","updated_at":"2026-04-30T10:35:34.529Z","avatar_url":"https://github.com/GlennChia.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# 1. Creating an ssm document (CLI)\n\nThe AWS documentation for [Create an SSM document (command line)](https://docs.aws.amazon.com/systems-manager/latest/userguide/create-ssm-document-cli.html) shows the commands needed to creating ssm document from a custom yml document\n\nTo pass parameters in, we do that during the create automation stage after the document has already been created.\n\nCommands for creating an ssm document\n\n```bash\naws ssm create-document ^\n    --content file://RHEL8_AMI.yml ^\n    --name \"RHEL8_AMI\" ^\n    --document-type \"Automation\" ^\n    --document-format \"YAML\" ^\n    --tags Key=Name,Value=RHEL8 Key=Environment,Value=Dev\n```\n\nCommands for updating an ssm document\n\n```bash\naws ssm update-document ^\n    --content file://RHEL8_AMI.yml ^\n    --name \"RHEL8_AMI\" ^\n    --document-version $LATEST ^\n    --document-format \"YAML\"\n```\n\nNote: To specify a profile use\n\n```bash\naws ssm create-document ^\n    --profile \"ssmtest\" ^\n    --region \"ap-southeast-1\" ^\n    --content file://RHEL8_AMI.yml ^\n    --name \"RHEL8_AMI\" ^\n    --document-type \"Automation\" ^\n    --document-format \"YAML\" ^\n    --tags Key=Name,Value=RHEL8 Key=Environment,Value=Dev\n\naws ssm update-document ^\n    --profile \"ssmtest\" ^\n    --region \"ap-southeast-1\" ^\n    --content file://RHEL8_AMI.yml ^\n    --name \"RHEL8_AMI\" ^\n    --document-version $LATEST ^\n    --document-format \"YAML\"\n```\n\n# 2 SSM document\n\n## 2.1 aws:runInstances\n\nDocumentation for [aws:runInstances – Launch an EC2 instance](https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-action-runinstance.html) provides relevant examples\n\n## 2.2 User data\n\nThe first user data script installs the ssm agent\n\n- Installing the ssm agent requires the installation url to use the correct region\n- Before conversion, set the user data script to the correct region\n\nTo convert the user data scripts to base 64, run `base64 -w0 \u003cscript_name\u003e.sh`\n\nCommand to edit the parameter in the step directly (archive). We are taking the approach of adding it as the default value\n\n```bash\nsed -i \"s/'{{ InstallSSMAgentUserData }}'/`base64 -w0 ssm_agent_install.sh`/g\" RHEl8_AMI.yaml\n```\n\n## 2.3 Create image\n\nRefer to [aws:createImage – Create an Amazon Machine Image](https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-action-create.html) for documentation and code snippets\n\n# 3. Console guide\n\n## 3.1 Running an automation\n\nAfter creating the document, click Automation on the left panel -\u003e Execute automation\n\n![](assets/01_automation_console.PNG)\n\nWe then see the document and have an overview of the created document. Clicking Next reveals more details and allows us to execute the execution\n\n![](assets/02_execute_automation.PNG)\n\nFrom the screen shown we can execute execution from the console or use a shareable link or get a command that we can execute from the CLI (change preference via the dropdown)\n\n![](assets/03_execute_automation_2.PNG)\n\n![](assets/04_execute_automation_3.PNG)\n\nThis shows up in the execution table\n\n![](assets/05_execute_automation_verification.PNG)\n\n\n\n\n\n## 3.2 Patching and patch baselines\n\n### 3.2.1 Predefined patch baselines\n\nSystems Manager -\u003e Patch Manager -\u003e View predefined patch baselines\n\n![](assets/06_patch_baselines_predefined.PNG)\n\nExample of the Red Hat Baseline\n\n![](assets/07_patch_baselines_predefined_rhel.PNG)\n\n### 3.2.2 Creating a baseline\n\nSystems Manager -\u003e Patch Manager -\u003e View predefined patch baselines -\u003e Create patch baseline. Configure approval rules, patch exceptions, Patch Sources and tags\n\nSet the Name and Operating System\n\n\u003cimg src=\"assets/08_patch_baseline_create1.PNG\" style=\"zoom:50%;\" /\u003e\n\nSet the approval rules (In this case I just set to all and auto approve immediately)\n\n\u003cimg src=\"assets/09_patch_baseline_create2.PNG\" style=\"zoom:50%;\" /\u003e\n\nThen I leave the rest as defaults and Create patch baseline\n\n### 3.2.3 Assign a patch group\n\nOnce the baseline has been created, Systems Manager -\u003e Patch Manager -\u003e View predefined patch baselines -\u003e Search through the pages to find the patch. Check the patch baseline -\u003e Actions -\u003e Modify patch groups\n\n![](assets/10_patch_group.PNG)\n\nGive the patch group a name and click `Add`\n\n\u003cimg src=\"assets/11_patch_group2.PNG\" style=\"zoom:50%;\" /\u003e\n\nHead to the Patch Group tab to verify\n\n![](assets/12_patch_group3.PNG)\n\n### 3.2.4 Configure patching\n\nThis is the step that  uses the patch baselines and patch groups created earlier\n\nThis AWS documentation, [About patch groups](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-patch-patchgroups.html) explains how patch groups find the instances they are supposed to patch\n\n- Note: In the 3.2.3 where we see the custom baseline, notice that it is not the default baseline for the Red Hat Enterprise Linux and this will influence how the baselines find the instances\n- First check is for the appropriate tag. Since the custom patch group is called \"rhelpatch\", instances that are to be patched with the custom baseline need to be tagged with the key `Patch Group` and value `rhelpatch`\n- If not, RHEL8 instances will default to the standard patch\n- If there is a key `Patch Group` but its value doesn't match existing patch groups then it will still use the default baseline\n\nThere are 3 options for selecting instances\n\n![](assets/13_configure_patching_select_instances.PNG)\n\nConfigure the patching schedule (here I just scan now) and operation\n\n![](assets/14_configure_patching_schedule_operation.PNG)\n\nUnder additional settings we see information that Patch Manager patches each instance using the registered patch baseline of its patch group.\n\n![](assets/15_configure_patching_additional_info.PNG)\n\nVerify that the command has been executed. Run command -\u003e Command history\n\n![](assets/16_run_patch_baseline.PNG)\n\nIn this case since no instances have the correct tag to match the patch group specified, there are no instances to scan.\n\n![](assets/17_run_patch_baseline2.PNG)\n\n## 3.3 Maintenance window\n\nMaintenance window -\u003e Create maintenance window -\u003e Steps are well guided. With the defaults, only Name, Duration and Stop initiating tasks are compulsory. The maintenance window shows up in the table after creation\n\n![](assets/18_maintenance_window.PNG)\n\nClicking it shows the details configured earlier\n\n![](assets/19_maintenance_window2.PNG)\n\nRegister tasks\n\n![](assets/20_maintenance_window3.PNG)\n\nAccept the defaults and select the automation document. Select the targets, configure concurrency and error threshold\n\n![](assets/21_maintenance_window4.PNG)\n\n# 4. ARNs and IAM\n\n[Actions, resources, and condition keys for AWS Systems Manager](https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awssystemsmanager.html) shows a list of ARNs and the way to use resource tags to control access\n\nA sample of using resource tags is in the snippet below. Here I ban getting any parameter that starts with prod if there isn't a tag which says read: yes\n\n```json\n{\n    \"Effect\": \"Deny\",\n    \"Action\": [\n        \"ssm:GetParameter*\"\n    ],\n    \"Resource\": [\n        \"arn:aws:ssm:*:*:parameter/prod*\"\n    ],\n    \"Condition\": {\n        \"StringNotEqualsIgnoreCaseIfExists\": {\n            \"ssm:resourceTag/read\": \"yes\"\n        }\n    }\n}\n```\n\n# 5. Useful Installs\n\n## 5.1 Utility installs\n\n```bash\nyum install vim -y\nyum install unzip -y\n```\n\nInstall dig\n\n```bash\nsudo dnf install bind-utils -y\n```\n\n## 5.2 Install AWS CLI\n\nBy default, installing this will install this to `/usr/local/bin/aws`\n\n- Can run in normal user with `aws`\n- Can run in root with `/usr/local/bin/aws`\n\n```bash\ncurl \"https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip\" -o \"awscliv2.zip\"\nunzip awscliv2.zip\nchmod -R +x aws\nsudo ./aws/install\n```\n\nSetting the `aws` command to be able to run in root\n\n```bash\nalias aws=\"/usr/local/bin/aws\"\nsource ~/.bash_profile\n```\n\n## 5.3 Install git\n\n```bash\nsudo dnf install git -y\n```\n\n## 5.4 Install python\n\n```bash\nsudo yum install python3 -y\n```\n\n## 5.5 Install docker\n\n```bash\nsudo su\n# Enable Docker CE package repository\ndnf config-manager --add-repo=https://download.docker.com/linux/centos/docker-ce.repo\n# Check available docker version\ndnf list docker-ce\n# Install the latest version of docker\ndnf install docker-ce --nobest -y\n# start and enable docker's service\nsystemctl start docker\nsystemctl enable docker\n```\n\nAlternatively, try to install the yum provided docker\n\n```bash\nsudo yum install docker -y\n```\n\n## 5.6 Install kubectl on Rhel\n\n[Install kubectl on Linux](https://kubernetes.io/docs/tasks/tools/install-kubectl/)\n\n```bash\ncat \u003c\u003cEOF \u003e /etc/yum.repos.d/kubernetes.repo\n[kubernetes]\nname=Kubernetes\nbaseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64\nenabled=1\ngpgcheck=1\nrepo_gpgcheck=1\ngpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg\nEOF\nyum install -y kubectl\n```\n\n## 5.7 Install helm\n\n[Installing Helm](https://helm.sh/docs/intro/install/)\n\n```bash\ncurl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3\nchmod 700 get_helm.sh\n./get_helm.sh\n```\n\n## 5.7 Install Wireshark\n\n[How to install wireshark on RHEL 8/CentOS 8 Linux](https://linuxconfig.org/install-wireshark-on-linux-redhat-8)\n\n```bash\ndnf install wireshark-cli -y\n```\n\nVerify the install\n\n```bash\nrpm -qa | grep -i wireshark\ntshark -v\n```\n\n## 5.8 Node\n\n```bash\ndnf groupinstall \"Development Tools\" -y\ndnf module install nodejs -y\n```\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fglennchia%2Frhel8-systems-manager","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fglennchia%2Frhel8-systems-manager","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fglennchia%2Frhel8-systems-manager/lists"}